InStarting Up SecuritybyRyan McGeehan·Oct 8, 2025Writing a risk scenarioA risk scenario is a fictional but plausible event that could harm your organization. Writing one well improves communication with others…
InStarting Up SecuritybyRyan McGeehan·Jul 17, 2025The “Working from China” ProblemWhen employees want to work remotely from “risky” places
InStarting Up SecuritybyRyan McGeehan·Sep 10, 2024Prioritizing Detection EngineeringDetection Engineering is a concept that has emerged in the detection space. It acknowledges the complexity of a detection stack and the…A response icon1A response icon1
InStarting Up SecuritybyRyan McGeehan·Aug 14, 2024Managing a quarterly security reviewI like an approach that combines my favorite quarterly review practices I’ve been exposed to. Here’s the general meeting structure:
InStarting Up SecuritybyRyan McGeehan·Nov 9, 2023Follow-Up: SolarWinds Response to SEC LawsuitSolarWinds has responded on their blog regarding the SEC’s lawsuit against them following their breach. Here is some analysis:
InStarting Up SecuritybyRyan McGeehan·Nov 6, 2023Lessons from the SEC’s Lawsuit against SolarWinds and Tim BrownA few days ago, the SEC filed a lawsuit against SolarWinds and their CISO that shares some similarities with the blameless post-mortem of…
InStarting Up SecuritybyRyan McGeehan·Oct 9, 2023Vulnerability Management: You should know about EPSSThe Exploit Prediction Scoring system (EPSS) is great. You might like it, too, if you deal with large amounts of vulnerabilities.A response icon2A response icon2
InStarting Up SecuritybyRyan McGeehan·Aug 24, 2023Beyond Controls: The Power of Risk ScenariosScenarios are an underappreciated way to model infosec risk. A scenario is simply a future, consequential event you write to express a risk…A response icon1A response icon1
InStarting Up SecuritybyRyan McGeehan·Mar 20, 2023Talking about risk with thresholds 🔥Imagine you encounter a fire in the woods. You’d instinctively decide to do one of two things:A response icon1A response icon1
InStarting Up SecuritybyRyan McGeehan·Dec 8, 2022A blameless post-mortem of USA v. Joseph SullivanOur industry deserves a complete retrospective into the incidents behind the criminal case against Uber’s former Chief Security Officer.A response icon1A response icon1
